vanhelsing

General

Target
Vanhelsing-0b.zip
Size 744KB
Sample250404-a7kghsxtcv
SHA256 957cb4dc89a03d833f23a3ff8eedee485a9e53cda256127720db563a7930e862
MD5 478ab4fb775f98d27ac24c46299bba3f
SHA1 c688aa58e8e91bf266688f6e98687f68bb6b6211
SHA512 61d7c594b19cb117f3f40624b4c75becf64ecf5efbed49078c61885286de3b9412f7d5d119b177114bb1a0a0b12cda2dfa631a6f41dd634143691fc6414c3833
SSDEEP 12288:Jrw0E0yJd/wj9dTpf3HVPGYCcfH8J3aebyAmNQEcdOHxo60CKHBBnYm:NPyd/K3k2sbyCdKxRKHBBYm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\README.txt

Ransom Note

--= No news is a good news ! =-- Your network has been breached and all your files Personal data, financial reports and important documents has been stolen , encrypted and ready to publish to public, if you willing to continue your bussines and make more money and keep bussines secret safe you need to restore your files first, And to restore all your files you have to pay the ransom in Bitcoin. don't bother your self and wast your time or make it more harder on your bussines , we developed a locker that can't be decrypted using third part decrypters . making your self geek and trying to restore the files with third part decrypter this will leads to lose all your date ! and then the even you pay the ransom can't help you to restore your files even us. to chat with us : 1 - Download tor browser https://www.torproject.org/download/ 2 - go to one of these links above http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion 3 - you will be asked for your ticket id to enter the chat this for you : TICKET ID 77565753618715415149 usefull links : #OUR TOR BLOG : http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

URLs

http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion
http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion
http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion
http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion
http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion
http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion
http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

Targets

- Target
  Vanhelsing-0b.exe
- Size 1.4MB
- SHA256 86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17
- MD5 5c254d25751269892b6f02d6c6384aef
- SHA1 79106dd259ba5343202c2f669a0a61b10adfadff
- SHA512 ebde8f69487bf89570169fad50b494afb8859caf309bc6dde05979881100daebbcd38873277dc45f0108715f70418b3c9364909ec5a8bcb0ec2faac815a2f11e
- SSDEEP 24576:lVN4zWHoN+fFqqPuD6Iedm2q3QKtgNIGqvKD9McwPDCkw6Bh0lhSMXlemqth5yR1:Fo5+fFqgdh02q3ntgNLqw9nwPDC7bODU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

vanhelsing discovery ransomware spyware stealer
- VanHelsing
  VanHelsing ransomware was first observed in March 2025.
  ransomware vanhelsing
- Vanhelsing family
  vanhelsing
- Renames multiple (263) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1